WCF authentication "friendly" to non-Microsoft clients?

Question

An exploratory question, here. After some reading, I'm getting a sinking feeling that WCF's authentication options aren't "friendly" to non-Microsoft clients, or require a great deal of effort to implement. I'm building a REST WCF service for which I wanted some kind of simple digest authentication; e.g. I store a username and password in Web.config and share that with the team that will use the service. The team that will consume this service is a legacy shop not versed in Microsoft tooling or helpers; e.g. ANSI C/C++, PHP, etc.

Anyway, MSDN tells me that digest authentication requires that the server be in a domain. I don't want or need this service to be in a domain. That seems like an odd requirement. So I dismissed that option.

So I read about NTLM and Windows authentication, but I worry that I'd be imposing a burden on the other team by only supporting Microsoft-flavored, proprietary authentication methods; won't they have to put forth a lot more effort to code against such a service? These methods seem intrinsically tied to concepts like Windows domains and user accounts, etc.

Answer 1

Windows Authentication is intended for use in intranet services where there is a domain controller you can use to manage your credentials and authorization.

You need to check the Forms Authentication, that will probably meet your needs.

Answer 2

If you just look for "friendliness" then you can go for basic authentication which is pretty much supported everywhere.

However, unless that is coupled with some kind of transport level encryption then passwords will be transferred in clear text - a pretty bad situation security-wise.

NTLM and kerberos authentication is supported by several non-WCF technologies does but a burden/requirement on the environment in which the are used.

You could look into some kind of message level authentication meaning that the credentials will be part of the message instead of handled by the transport. WCF supports the WS-* specifications that relate to message level security. Those specifications are again not tied to WCF or Windows.

I sounds like the simplest way in your setup would be to use basic authentication and use HTTPS for the transport.